Loading malware…
Qilin, also known as Agenda, is a ransomware family and ransomware-as-a-service operation active since 2022. Its Russian-speaking operators supply affiliates with customizable payloads, negotiation portals, and data-leak infrastructure in exchange for a share of ransom payments. The operation conducts double extortion, combining data theft with encryption and threats to publish stolen information. Qilin targets organizations worldwide across healthcare, manufacturing, financial services, professional services, government, and other sectors. Its June 2024 attack on pathology provider Synnovis significantly disrupted NHS hospital services in London. Symantec tracks the operation's core actor as Stinkbug; the North Korean state-sponsored actor Moonstone Sleet has also deployed Qilin.
Originally written in Go, Qilin subsequently introduced Rust-based payloads, including Qilin.B. Variants target Windows, Linux, and VMware ESXi environments. The ransomware supports configurable full and intermittent encryption of local files, attached drives, and network shares. Qilin.B uses AES-256-CTR with AES-NI acceleration where available or ChaCha20, protecting encryption keys with RSA-4096. Windows functionality includes token impersonation for SYSTEM-level execution, Active Directory host discovery, and propagation through PsExec; Qilin also supports distribution through VMware vCenter.
Affiliates obtain access through phishing, compromised remote-access credentials, exposed remote services, and exploitation of vulnerable internet-facing systems, including Fortinet appliances and Veeam Backup & Replication installations. Intrusions involve credential harvesting, network enumeration, lateral movement, and data exfiltration using legitimate administration and transfer tools. Qilin terminates selected processes and services, clears event logs, deletes Volume Shadow Copies, and can execute in Safe Mode to impair defenses and recovery. Operators additionally compromise backup infrastructure and have deployed Killer Ultra, a separate defense-impairment tool that exploits a vulnerable Zemana driver to terminate endpoint security processes.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-20316 has a CVSS score of 5.3 and allows a remote attacker to log in with low privileges, then use other previous FMC vulnerabilities to escalate privileges. UAT 11988 is exploiting it to distribute Qilin ransomware. | The other threat cluster, UAT 11988, is exploiting CVE-2026-20316 to distribute Qilin ransomware.
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools, such as Cobalt Strike, BloodHound and SharpHound. | ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools.
They have been observed exploiting vulnerabilities in edge devices, including Citrix ADC (CVE-2019-19781).
Recent intelligence also links them to the exploitation of the "React2Shell" vulnerability.
Malware, Tools, Vulnerabilities, and TTPs Used in Qilin Campaigns — Vulnerabilities: CVE-2023-27532, CVE-2024-21762, CVE-2024-55591
Malware, Tools, Vulnerabilities, and TTPs Used in Qilin Campaigns — Vulnerabilities: CVE-2023-27532, CVE-2024-21762, CVE-2024-55591
The Qilin Ransomware Group report lists CVE-2025-31324 under “MITRE CONTEXT — Exploits Vulnerabilities.”
They have been observed exploiting vulnerabilities in edge devices, including Citrix ADC (CVE-2019-19781), Fortinet VPNs, and the critical "ZeroLogon" vulnerability (CVE-2020-1472) in Windows Domain Controllers.
Malware, Tools, Vulnerabilities, and TTPs Used in Qilin Campaigns — Vulnerabilities: CVE-2023-27532, CVE-2024-21762, CVE-2024-55591
The Qilin Ransomware Group report lists CVE-2023-4966 under “MITRE CONTEXT — Exploits Vulnerabilities.”
Le evidenze analizzate confermano lo sfruttamento attivo di vulnerabilità note su appliance di Mobile Device Management (MDM) Ivanti (CVE-2026-1281 e CVE-2026-1340). | Il gruppo ha evoluto il proprio codice originario (scritto in Go) in una variante più robusta basata su Rust ... Qilin adotta una strategia di doppia estorsione, esfiltrando dati sensibili prima della cifratura.
Ivanti Endpoint Manager Mobile (EPMM): identificata tramite la CVE-2026-1281 di tipo “Code Injection” e con score CVSS v3.1 pari a 9.8. | Il gruppo ha evoluto il proprio codice originario (scritto in Go) in una variante più robusta basata su Rust ... Qilin adotta una strategia di doppia estorsione, esfiltrando dati sensibili prima della cifratura.
Killer Ultra is packed with a vulnerable version of Zemana AntiLogger leveraging CVE-2024-1853 for Arbitrary Process Termination.
In June this year, Qilin was exploiting a critical authentication bypass vulnerability in Check Point VPN and firewall products, tracked as CVE-2026-50751. | Also known as Agenda, Qilin has been active since August 2022 and has become one of the most prolific ransomware-as-a-service (RaaS) operations, hitting hundreds of organizations worldwide and causing millions of dollars in damages.
Active exploitation of Cisco Secure Firewall Management Center (FMC) vulnerabilities CVE-2026-20079 and CVE-2026-20316, enabling authentication bypass, unauthorized access, and privilege escalation.
26 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The other threat cluster, UAT 11988, is exploiting CVE-2026-20316 to distribute Qilin ransomware.
ReliaQuest confirmed that the Qilin and Settra ransomware groups are actively exploiting the flaw, with observed accompanying deployment of offensive security tools.
The article investigates a leaked Qilin ransomware affiliate panel and the tooling interests of affiliate “hastalamuerte.”
A pivotal moment in Qilin’s technical evolution was the transition from the original Golang codebase to a new variant written in Rust, often referred to by researchers as Qilin.B.
Qilin ransomware has been active since at least May 2022. Qilin operates under a Ransomware-as-a-Service (RaaS) model.
A pivotal moment in Qilin’s technical evolution was the transition from the original Golang codebase to a new variant written in Rust, often referred to by researchers as Qilin.B.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
However, there is no confirmed evidence that Qilin operators have utilized these exploits.
The ransomware first deletes all system logs before initiating data encryption.
However, there is no confirmed evidence that Qilin operators have utilized these exploits.
The malware begins by encrypting all data on the host and any attached drives, including network shares.
Post-encryption activities include ... terminating specified services or processes.
326 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware cited as a background example of identity-system abuse. The referenced investigation involved attackers abusing Active Directory replication to collect domain credentials.
A ransomware-as-a-service platform central to the affiliate dispute described in the article. Hastalamuerte alleged that a victim's recovery intermediary negotiated directly with Qilin support, agreeing to a $200,000 payment, after which the relevant Tox conversation disappeared. Qilin rejected his demand for a $48,000 share, and the forum resolved the dispute against him on July 31. These are reported allegations, not independently established facts.
Named ransomware operation actively exploiting CVE-2026-0257 in Palo Alto Networks products to establish unauthorized VPN sessions and gain initial access to internal networks. The reported activity includes deployment of offensive security tools.
A ransomware-as-a-service operation active since 2022 that enables affiliates to deploy customized payloads. It uses double extortion, encrypting data and threatening publication through Tor-based leak portals. The article describes phishing and exploitation of unspecified known vulnerabilities, global bulletproof hosting infrastructure, and continued attacks after a suspected leader's detention in Japan and extradition to Germany.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.